Security Management Practice Guidance Note Closed Circuit Television (CCTV)-V03 Date Issued Issue 7 Sep 17 Issue 8 Dec 17 Issue 9 Mar 18 Planned Review September- 2018 SM-PGN 01- Part of NTW(O)21 Security Management Policy Author/Designation Responsible Officer / Designation Tony Gray- Head of Safety, Security and Resilience Craig Newby- Deputy Head of Safety, Security and Resilience Tony Gray- Head of Safety and Security Contents Section Description Page No 1 Introduction 1 2 Definition 1 3 Legal framework 2 4 Legal requirement on all service providers for the implementation and use of CCTV systems 3 5 Responsibilities 5 6 Purpose 6 7 Key objectives 6 8 Targeted observations 7 9 Classification of areas 7 10 Information 8 11 Covert surveillance 9 12 Procurement/maintenance 9 13 Installation/signage 10 14 Subject access 10 15 Breaches of this policy 11 16 Complaints procedure 11 17 Monitoring and review 11 18 CCTV system inventory 11 19 Glossary of terms 11 Appendices listed separate to PGN Document No: Appendix 1 Appendix 2 Appendix 3 Appendix 4 Appendix 5 Appendix 6 Description CCTV schemes currently in operation Operational procedures for the control and use of CCTV Application for access to recorded images Installation checklist CCTV Sign Request for CCTV Assistance SM-PGN- 01 Closed Circuit Television (CCTV) Issue 9 Mar 2018
1 INTRODUCTION 1.1 (The Trust), places the health, safety and welfare of its service users and carers, staff and visitors high amongst its priorities and will ensure it maintains safe and secure conditions throughout the organisation. It will work closely with partner organisations where the health, safety and welfare have shared ownership, to ensure co-operation at all levels. 1.2 The Trust has a legal duty to comply with the Secretary of State for Health Directions for Security Management. 1.3 Closed circuit television (CCTV) is now widely used within NHS care settings with the express intention of providing a safe environment for service users, staff and visitors. CCTV can only be operated and used safely within a stringent framework encompassing legal and regulatory requirements. 1.4 The use of CCTV systems within NHS care settings must be risk assessed in line with the Trust procedures and protocols in order to assure safe systems of work. 1.5 The policy has been written to take in the latest available information from NHS Protect. 1.6 The Trust will identify which CCTV systems it has legal ownership of and will work with partner organisations to ensure that where those organisations have legal ownership of systems that cover our business activities, the necessary legislation has been considered. 1.7 The overall purpose of CCTV schemes is to help reduce the fear of crime for Trust staff, service users and carers, and visitors (particularly those who are entering and leaving the Trust premises during out of hours) and to protect the Trust premises from criminal activities. They will also on occasions following risk assessment be used to enhance the security of service users within in-patient areas, monitoring access within in-patient areas with the express intention: - To assist in the prevention and detection of crime against both persons and property To facilitate the identification, apprehension and prosecution of offenders in relation to crime To ensure the security of property belonging to the Trust and to employees and visitors of the Trust 2 DEFINITION 2.1 A CCTV system is any part of a Trust s security system used expressly with the intention of providing a safe environment, this not only covers the cameras but also the monitors, PC systems and any attached recording devices used within the process. 2.2 Any removable drives, including CD s, DVD s, hard drives and video tapes will be deemed to be part of the CCTV system and will also be covered by the content of this policy. 3 LEGAL FRAMEWORK 3.1 The use of CCTV systems is controlled by a number of statutes and regulations: - The Human Rights Act 1998 2
The Data Protection Act (DPA) 1998 The Regulation of Investigatory Powers Act 2000 The Code of Practice to the Mental Health Act 1983 CCTV Systems and the Data Protection Act 1998 (DPA): Guidance issued by the Information Commissioner: 2004 The Security Management Service: NHS Security Manual 2005 4 LEGAL REQUIREMENT ON ALL SERVICE PROVIDERS FOR THE IMPLEMENTATION AND USE OF CCTV SYSTEMS 4.1 Article 8 of the Human Rights Act 1998 protects the right to respect for private and family life. No public authority may interfere with this right except when in accordance with the law and when necessary. 4.2 Any such interference by a public authority must be proportional to the threat or risk to community safety, comply with all relevant legal requirements, be necessary for safety and the prevention and detection of crime and, cause the minimum of interference to the individual. The use of CCTV systems must therefore be open to scrutiny and be fully documented. 4.3 All staff involved in the operation or monitoring of CCTV images have a responsibility to comply with the provisions of the DPA 1998 and the CCTV Code of Practice 2000 and must therefore act in accordance with the requirement of the Data Protection Act and the Information Commissioner. Any failure to do so may constitute an offence under the DPA 1998. 4.4 The principles of the DPA 1998 require that: - Personal data shall be processed fairly and lawfully Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed Personal data shall be accurate and, where necessary, kept up to date Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes Personal data shall be processed in accordance with the rights of data subjects under this Act Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing or personal data and against accidental loss or destruction of, or damage to, personal data Personal data shall not be transferred to a country or territory outside the European Economic Area, unless that country or territory ensures an adequate level or protection for the rights and freedoms of data subjects in relation to the processing of personal data. 4.5 The Trust must adhere to the following guidelines, to conform to this Code of Practice: - Site/Services Managers operating such schemes within premises they manage will be responsible for overseeing that monitoring of all images is done so in accordance with this policy and that suitable operation, backup, retention, destruction and maintenance of all storage media is conducted in accordance with the written operational procedures (see Appendix 2) 3
Cameras will not be hidden from view and appropriate steps must be taken, e.g. by signage and displaying posters, to inform the public of the presence of the system and its ownership at all times To ensure privacy the cameras are fixed and focussed only upon Trust property, which must be demonstrable upon specific request Images from the cameras are appropriately recorded in accordance with existing operational procedures (see Appendix 2) There is no sound recording undertaken from any part of the system 4.5 The Data Protection Commissioner must be notified that the health body intends to process CCTV data and the purpose for which this data should be processed. 4.6 A renewal on the use of CCTV systems must be undertaken annually. The Head of Facilities as part of their day-to-day operational responsibility will complete this. This should normally be undertaken as part of the overall registration and renewal process for all data protection for the health body. 4.7 To comply with the guidance issued by the Data Protection Commissioner and the DPA 1998 the Trust must formally notify the Information Commissioner covering the proposed use of CCTV for the specified purposes. 4.8 The Trust must have a formal assessment of the reasons for using CCTV and its appropriateness including its operation in communal and/or private spaces. 4.9 Formal notification to the Information Commissioner under the DPA covering the proposed use of CCTV for the specified purposes is required on an annual basis. 4.10 The identity of the person responsible for the day-to-day compliance with this policy, as listed in responsibilities in section 5. 4.11 A policy reflecting CCTV protocol, procedures, implementation and audit. 5 RESPONSIBILITIES 5.1 Chief Executive 5.1.1 The Chief Executive on behalf of The Trust retains ultimate accountability for the health, safety and welfare of all service users, staff and visitors, however, key tasks and responsibilities will be delegated to individuals in accordance with the content of this policy. 5.2 Security Management Director (Executive Director of Nursing and Chief Operating Officer) 5.2.1 The Executive Director of Nursing and Chief Operating Officer in their capacity as the Trust s nominated Security Management Director and in line with NHS Protect standards shall assume responsibility on behalf of the Trust Board for all aspects of Security within the Trust. They will ensure that all management arrangements are in place to ensure compliance with this policy. The Security Management Director will assume the role of data owner on behalf of The Trust. 5.3 Associate Director of Clinical Governance 5.3.1 The Associate Director of Clinical Governance shall ensure that all security provisions are administered in line with all other Trust policies and will liaise with all clinical specialities to ensure that the Trust can comply with all of its Clinical Governance responsibilities. 5.4 Local Security Management Specialists (LSMS) 4
5.4.1 The Local Security Management Specialists has the day-to-day responsibility of security management to assist the Security Management Director to implement all aspects of security provision within the Trust including the delivery of directives issued by NHS Protect. The LSMS will conduct an annual audit of CCTV systems in compliance with respective legislation and will be the Trust lead for the day-today compliance with this policy. The LSMS will produce quarterly and annual reports for all security related information for all Trust-wide forums as appropriate. The LSMS will act as a point of contact for the authorisation of any proposed CCTV system liaising closely with the Security Director and provide advice and guidance on their use. 5.4.2 They will also: - Ensure compliance with this Policy Ensure that the operating procedures for all schemes are complied with at all times Ensure that the purposes and objectives of all schemes are not exceeded Notify all persons on the Trust property where CCTV is installed and that a CCTV scheme is in operation. When a decision has been made to install CCTV into communal patient areas, and whenever new patients enter the ward, service users and carers, staff and visitors should be advised of the system and the reasons for its use Facilitate formal subject access requests of any images captured under the terms of the Data Protection Act 1998 Provide copies of this Policy when required to do so Will ensure Scheme Managers are aware of their responsibilities to comply with this policy 5.5 Scheme Managers (Service Managers) 5.5.1 Scheme Managers are responsible for the day-to-day management (appendix 2 refers) of CCTV systems under their control and within their designated work area. 6 PURPOSE 6.1 CCTV schemes should not be initiated, installed, moved or replaced without prior approval by the Security Director, or someone delegated to approve such schemes. The Data Protection Officer must also be informed. 6.2 All schemes will be monitored and managed using the following procedures and must be formally approved (as above) prior to any installation. 6.3 Local Security Management Specialists will assess the appropriateness of, and reasons for, using CCTV or similar surveillance equipment and consult with NHS Protect. Where necessary consideration must be given to less intrusive means of achieving the desired objective. 6.4 The assessment process and the reasons for the installation of the scheme will be clearly documented. 6.5 Assessment/findings will be shared with the Group involved. Once agreement has been gained it must be logged with the IM&T Steering Group. 6.6 The purpose of the scheme will be documented in accordance with current legislation. 5
6.7 The Data Protection Notification must be checked prior to introduction of new CCTV schemes to ensure compliance with Data Protection legislation. 6.8 The person(s) or organisation(s), who are responsible for ensuring the day-to-day compliance with the operational requirements of such schemes and this policy will be documented. 6.9 Each CCTV system will have an accountable Scheme Manager, who is responsible on a day-to-day basis for the appropriateness of its use. This will generally be the senior manager of the unit/area concerned. 6.10 The Local Security Management Specialists will liaise with all external providers of CCTV Schemes in order to monitor the effectiveness of the scheme. 7 KEY OBJECTIVES 7.1 Through this policy the Trust will use its CCTV schemes to achieve the following: - Creating a pro-security culture Deterring those who may be minded to breach security Preventing security incidents or breaches from occurring Detecting security incidents or breaches Investigating security incidents or breaches Applying sanctions against those responsible for security incidents or breaches Seeking redress through criminal and civil justice systems from those responsible for security incidents 8 TARGETED OBSERVATIONS 8.1 Use of electronic surveillance may have practice and ethical considerations for patients and staff. Staff should therefore be clear as to why they are using this approach and the suitability for patients as well as level of risk. 8.2 Only for specifically defined instances and in accordance with the declared purposes and objectives of these schemes, may such surveillance equipment be used for targeted observation. Under no circumstances should CCTV be considered a general substitute for the use of skilled staff as a method of observing patient behaviour or interaction with patients. 8.3 The Regulation of Investigatory Powers Act 2000 regulates the use of covert/directed surveillance of this type and is subject to a strict code of practice. Use of CCTV in these instances or for any other reason other than that authorised in accordance with this policy is not permissible at any time or circumstance. Covert Surveillance will only be permitted with approval of the Police Authority or NHS Protect, who will give approval when appropriate. 8.4 Practical steps to be taken should therefore be: - Assessment of the appropriateness and reasons for using CCTV should be clearly documented in the patient s notes A sign on the door of the observation room should make clear that electronic surveillance is in place Service users and / or their carers must be made aware of the surveillance Service users and / or their carers should be made aware that they could discuss the situation with their care coordinator or nurse in charge 6
Such schemes should be reviewed on a regular basis in order to perpetually revisit the rationale behind the decisions to use the technology. 9 CLASSIFICATION OF AREAS 9.1 Public Areas 9.1.1 These are areas of the Trust to which the public have unrestricted access, i.e. the hospital site, outpatient departments, community facilities, hospital corridors, reception areas, restaurants. 9.1.2 As elsewhere in Britain CCTV is commonly in use in the public areas of hospitals, there are no special considerations required beyond those placed by the Information Commissioner on all CCTV cameras, such as signage, registration etc. for instance it could be used to monitor the access and egress of persons to and from Trust facilities to protect service users within those areas and to deter those who have no business there. 9.2 Communal Areas 9.2.1 These are areas of the Trust shared by all patients; they include day rooms, dining rooms, activity rooms, beverage bays, ward corridors and family rooms. 9.2.2 CCTV may be used in communal patient areas where the security of either service user or public safety justifies this. It is central to any decision that, in line with the requirements of the Information Commissioner, a clear reason for installation is available. 9.3 Private Areas 9.3.1 These are those areas where the individual might reasonably expect privacy; these include bathrooms, bedrooms, toilets and seclusion rooms. 9.3.2 The legal basis for using CCTV in private spaces arises either from the service user s capacity to consent or because such monitoring is a proportionate response to compulsory treatment and is proportionate in an individual case. This means that while it may be legal to use cameras in bedrooms, seclusion rooms and toilets, there would be a considerable burden on the provider to prove that the intrusion was appropriate. 9.3.3 It is also arguable that the burden would be higher if the cameras were linked to a recording device, rather than merely providing real-time unrecorded images. 9.3.4 The Trust has deemed at this time that there is not a need to have CCTV in private areas, but will review this on a regular basis. 9.3.5 Any issues of concern regarding private areas can be discussed with the Trust s Local Security Management Specialists. 10 INFORMATION 10.1 Where a decision is made to install CCTV into service user areas, or new service users enter the ward or local environment, it is recommended that the service users and/or their carers are advised of the system and potential benefits it can offer in contrast to traditional systems. Whilst a service user s consent is preferable, it is not required when the purpose of the system is in the best interests of the service user. 10.2 Where possible, all new service users should be directed to the location of the Trust s CCTV policy and shown the locations of all cameras (specific to service area). 7
10.3 It is recommended that all service users and / or their carers are given a leaflet on the use of CCTV cameras and that the service user s understanding of the matter is recorded along lines similar to those use for informing detained service users or their rights under Section 132 of the Mental Health Act 1983: - The staff member briefing the service user about the use of CCTV should sign that and when they had done so The staff member should provide a written assessment of the service user s understanding of the system Where a service user does not understand, a date should be recorded for the next attempt to explain the practice 11 COVERT SURVEILLANCE 11.1 Definition 11.1.1 Covert surveillance is defined as: - Any surveillance which is carried out in a manner calculated to ensure that the persons subject to the surveillance are unaware that it is or may be taking place. Source: Regulation of Investigatory Powers Act 2000 11.1.2 CCTV must be overt unless a specified operation for a specific purpose is being undertaken in circumstances necessary for the prevention or detection of crime, the apprehension or prosecution of offenders or the assessment or collection of any tax or duty. Under the Regulation of Investigatory Powers Act 2000 covert use of CCTV should only be used in exceptional circumstances. It is therefore absolutely essential that any covert CCTV operation is authorised by NHS Protect or the Local Police Authority. 11.2 Risk Assessment 11.2.1 In consideration of the authorisation, both the LSMS and the Security Director as part of the risk assessment process will consider the following: - The initial assessment must establish that covert surveillance is necessary The grounds on which the application is made The length of the duration of surveillance The equipment needed to carry out the surveillance The effect on the privacy of others 12 PROCUREMENT / MAINTENANCE 12.1 In order to ensure best value for money, selection and procurement of new/replacement CCTV systems, shall comply with the Trust s standing financial instructions. Depending on the size and complexity of the CCTV system, there may be a need to go out to tender. In these circumstances, any NHS contracts in operation at the time must be utilised, advice must be obtained from both the Estates Department and the Supplies Department. 12.2 Prior to procurement, a thorough and fully documented risk assessment must be carried out to establish the purpose that is intended and the appropriateness of the installation. The LSMS must be included within this process and be fully consulted on any plans. Part of the process will include an assessment on whether the CCTV system is the most viable option. This is imperative to ensure that the operation of any CCTV system should cause minimum interference with the privacy and rights of any individual. 12.3 In the interests of security, all maintenance staff must comply with all Trust policies and understand the importance of compliance with this policy whilst checking, repairing and testing all Trust CCTV systems. 8
12.4 The failure of any camera or associated CCTV equipment must be reported by Facilities staff. This should be reported to the appropriate maintenance contractor and an incident form should also be completed. 13 INTALLATION/SIGNAGE 13.1 When CCTV systems are installed, suitable notification must be made to ensure information has been provided of CCTV systems that are in operation and the reasons for their use. 13.2 Installations wherever possible must not impinge on private properties adjacent to the Trust. 13.3 In the interests of co-operation, where CCTV systems overlap partner organisations, the Trust, in the interests of safety and security, will assist and liaise with these organisations (both NHS and non-nhs) to prevent, deter and detect crime and co-operate with the Police Force to apprehend and prosecute offenders. 13.4 The installation of all schemes will remain appropriate to its original identified and documented business purpose in accordance with this policy. 13.5 Signs should be placed so that the public is aware that they are entering a zone, which is covered by surveillance equipment. The signage should be a least A4 size. 13.6 The signs should be clearly visible and legible to members of the public and should contain the following information: - Identity of the person or organisation responsible for the scheme The purposes of the scheme Details of whom to contact regarding the scheme 13.7 An example sign is included at Appendix 5. 14 SUBJECT ACCESS 14.1 Only the Data Protection Officer, in response to a formal request from the data subject, will permit subject access to the images monitored by the system either in hard copy format or by informal viewing. In instances where no recorded images are retained (instantaneous viewing only) data subjects will be informed that the system produces no recordable images and that subject access in these particular instances can only be granted for the purposes of determining the extent of the CCTV monitoring range only. 14.2 Individuals wishing to access images from the system or formal subject access requests specifically relating to CCTV must write to the Trust Data Protection Officer. This request must be dealt with in accordance with the Trust Subject Access Procedure. 15 BREACHES OF THIS POLICY 15.1 The Trust will investigate any breaches of this policy, using appropriate mechanisms, which may include the Serious Incident Policy or Disciplinary procedure. 15.2 As a major purpose of these schemes is in assisting to safeguard the health and safety of staff, service users and visitors, it should be noted that intentional or reckless interference with any part of any monitoring equipment, including cameras/monitor/back-up media, might be a criminal offence. 9
16 COMPLAINTS PROCEDURE 16.1 Complaints and grievances regarding the operation of the Trust s CCTV system may be progressed via the Security Director in compliance with the Trust s Complaints or grievance procedures. 17 MONITORING AND REVIEW 17.1 This Policy, its operation and the operation of the Trust s CCTV schemes will be reviewed annually by the Trust s nominated Local Security Management Specialists in association with the Information Governance Group. 18 CCTV SYSTEM INVENTORY 18.1 The LSMS will maintain and update annually an inventory of all Trust areas using CCTV systems. (See appendix 1) 19 GLOSSARY OF TERMS 19.1 Closed Circuit Television (CCTV) 19.1.1 A CCTV system is any part of a Trust s security system used expressly with the intention of providing a safe environment, this not only covers the cameras but also the monitors, PC systems and any attached recording devices used within the process. 19.1.2 Any removable drives, including CD s, DVD s, hard drives and video tapes will also be deemed to be part of the CCTV system and will also be covered by the content of this policy. 19.2 Data Protection Officer 19.2.1 The Data Protection Officer is the title given to the person who has nominated representative of the Trust for the purposes of the Data Protection Act 1998. 19.2.2 Firstly, a data controller is required to comply with the eight principles of good information handling (the Data Protection Principles), and secondly to let the Information Commissioner know certain details about themselves including the types of information held and the purposes for which they process personal data. 19.3 Local Security Management Specialist 19.3.1 A nationally accredited post who has responsibility for all security issues within an NHS Trust. 19.4 Scheme Manager 19.4.1 A Service Manager, who is responsible on a day-to-day basis for the legal and effective use of a CCTV Scheme. 10